I'm getting nearer the answer. All the entries in the log for localhost are hacking attempts: the usual stuff, but I've now realised that the directory is being created by the log splitting script - because there are failed attempts to access "localhost" in the log.

I'm not sure how to get round this.

Workaround I'm trying as I type:

1. Create a directory called web0 containing log/2006/01
2. Create a symlink called localhost
3. Run the logs.psp script
4. Delete the step 1 and 2 objects
5. Run the webalize.php script

As far as I recall, the basic problem I was having was that requests for unknown domains were beng split out to a localhost log directory. I think I got round this by creating a localhost directory that isn't under the www directory tree and putting a symlink to that instead of the localhost directory.

That means that the logfile splitting process has somewhere to put the logs, but the webalizer process doesn't look at the results. It seems to work for me, but I can't access the site from where I am today, so I'm writing from hazy memory.